<Sysname> system-view
[Sysname] ipsec logging packet enable
ipsec df-bit
Use ipsec df-bit to set the DF bit for outer IP headers of encapsulated IPsec packets on an interface.
Use undo ipsec df-bit to restore the default.
Syntax
ipsec df-bit { clear | copy | set }
undo ipsec df-bit
Default
The DF bit is not set for outer IP headers of encapsulated IPsec packets on an interface. The global DF bit
is used.
Views
Interface view
Predefined user roles
network-admin
Parameters
clear: Clears the DF bit for outer IP headers. In this case, the encapsulated IPsec packets can be
fragmented.
copy: Copies the DF bit of the original IP headers to the outer IP headers.
set: Sets the DF bit for outer IP headers. In this case, the encapsulated IPsec packets cannot be
fragmented.
Usage guidelines
This command is effective only when the IPsec encapsulation mode is tunnel mode. It is not effective in
transport mode because outer IP headers are not added in transport mode.
This command does not change the DF bit for the original IP headers of encapsulated packets.
If multiple interfaces have referenced an IPsec policy that is bound to a source interface, you must use
the same DF bit setting on these interfaces.
Packet fragmentation and re-assembly might cause packet forwarding delayed. If you set the DF bit for
encapsulated IPsec packets, the packets will not be fragmented. In this case, make sure the MTU on each
interface along the forwarding path is larger than the IPsec packet length. Otherwise, the packets are
discarded. If you cannot make sure of the MTU value, HP recommends clearing the DF bit.
Examples
# Set the DF bit for outer IP headers of encapsulated IPsec packets on VLAN-interface 1.
<Sysname> system-view
[Sysname] interface vlan-interface1
339
To Next Page
Loading...
Need help?
General
